Possible Issue with Grok Pattern Parsing on Website

[Sophisycho]

I have encountered a potential issue while using the Grok pattern parser on your website. When attempting to parse log entries, the extracted fields do not match the expected values, which suggests there may be a problem with the parsing logic.

Steps to Reproduce:

1. Input the following Grok pattern:

^\[%{TIMESTAMP_ISO8601:log_date}\] (?:\[%{NOTSPACE:track_id}/%{NOTSPACE:span_id}\])?(?:\[%{NOTSPACE:span_id}\])?%{SPACE}\[%{LOGLEVEL:log_level}(?:%{SPACE})?\] \[\[%{WORD}\] %{WORD}: '%{NUMBER:thread_name}' for queue:%{GREEDYDATA}- start\[%{TIMESTAMP_ISO8601:start_time}\]%{SPACE}end

2. Use the following sample log entry:

   [2025-02-18 11:43:02.867] [abcd1234] [INFO ] [[ACTIVE] ExecuteThread: '703' for queue: 'some.kernel.Default (self-tuning)']- start[2025-02-18 11:43:02]
   

3. Observe the extracted output.

Expected Behavior:

• log_date: "2025-02-18 11:43:02.867"
• span_id: "abcd1234"
• log_level: "INFO"
• thread_status: "ACTIVE"
• thread_name: "703"
• queue: "some.kernel.Default (self-tuning)"
• start_time: "2025-02-18 11:43:02"

Actual Behavior:

The extracted fields are incorrect:

• thread_name is being incorrectly parsed as INFO
• start_time is being incorrectly assigned a numerical value (e.g., 703)

Thank you for your time and for maintaining this great tool!

[Sophisycho]

Just replying to myself—I found that the issue seems to be caused by LOGLEVEL. After changing the grok pattern from LOGLEVEL to something else, like WORD, the problem disappeared.